Microcontroller systems of that kind are used to control diverse systems that are relevant to safety in motor vehicles, such as anti-lock braking systems, attitude control systems, hydraulic brake systems etc., the monitoring device serving to transfer the controlled device, such as a vehicle brake, attitude control actuators or the like, into a secured state when absence of the normal operation indicating signal indicates that the execution of the normal operation program by the microcontroller is defective and hence the operating reliability of the system as a whole is not guaranteed.
Absence of the normal operation indicating signal may be caused by the microcontroller having entered an undefined state, that is to say having crashed, as a result of a program error, or by the normal operation program having registered the existence of exceptional conditions and having triggered a complete or partial repetition of the operation preparation program to remedy those conditions.
In order that such a repetition may be carried out and normal operation may subsequently be resumed automatically, the transfer into the secured state when the normal operation indicating signal is absent is initially not yet final, so that, if the normal operation indicating signal returns within a predefined period of time, the controlled device is able to return from the secured state to its fully functioning operating state. Only when the normal operation indicating signal is missing for longer than the predefined period of time is the controlled device locked in the secured state, thus making a return to the fully functioning operating state impossible without external intervention.
If, for example, owing to an error in the programs of the microcontroller, execution of the normal operation program constantly leads to the occurrence of exceptional conditions, a conventional microcontroller system of that kind enters an endless loop which rotates through exceptional condition, repetition of the operation preparation program and execution of the normal operation program back to re-occurrence of the exceptional condition.